automatic lookup based on condition

mahe90 — Sat, 29 Aug 2020 17:49:11 GMT

Hi,

My CSV(test_csv_lookup) looks like this:

---

index; value

1, 1.1.1.1

---- here is my automatic lookup

LOOKUP-field_extract = test_csv_lookup index AS ip OUTPUTNEW value AS lookedup_val

I have two following events in the index for which I will apply the the above automatic lookup:

event1 - timestmap, 1

event2 - timestmap, 2.2.2.2.

In above event, the "ip" field values are "1", and "2.2.2.2", in the first event, "1" being the value of the "ip" , just refers to the index value of the lookup table and second event just contain raw value, and doesn't need lookup.

When I query for the index, the lookedup_val shows the "1.1.1.1". What I need is that, both the values(in the fieldlookedup_val) , that is "1.1.1.1" and "2.2.2.2". For the first event, its working fine, by looking up the index and able to retrieve, for the second event also it's doing the lookup and obviously it can't find. When lookup can't find the value, could it' use the raw value or default field value, in this case, 2.2.2.2? Is there a way I can specify this in automatic lookup output?

Thanks,

Re: automatic lookup based on condition

thambisetty — Sun, 30 Aug 2020 07:32:59 GMT

you can't do that. but you can write below in your search.

| eval lookedup_val = if(isnull(lookedup_val),ip,lookedup_val)

if you think, you can add this to props.conf, it won't work because first EVAL will be executed then Lookup configuration will be executed next.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence

topic automatic lookup based on condition in Splunk Search

automatic lookup based on condition

Re: automatic lookup based on condition